GrapheneOS Pixel 10 dilemma

General Privacy & Security
1

The next version of the Google Pixil phone is the Pixil 10. The Pixil 10 phone is the first phone to come with a built-in AI. The phone is so advanced that among several new features, it comes a real-time universal translator. You can make or reveive calls to and from anyone anywhere, regardless of language differences. As you and the other person speak to eachother, each of you hears the other person in your and their own respective languages, in real time. In addition, the other person hears you in your own voice, in their language. You hear them in your own language, but as their real voice.

The GrapheneOS team appears to be unsure if they can or should support a version of their operating system that runs on this Pixil 10 phone.

1 Like
2

  1. The Pixel 10 hasn’t been released yet. It should be released in a week.

  2. I don’t believe the “first phone to come with a built-in AI” unless “built-in” is different than what I think. I believe that the “live translation” feature is just some LLM software running on the new Gen5 Tensor chip. i.e. I think it’s optional software that is part of the default Pixel install. Just like Gemini and Gemini Nano are part of the default Pixel installs running the the current Pixel phones (Pixel 8 and Pixel 9) using their Tensor chips (specialized chips for LLM processing). The current GrapheneOS phones don’t use Gemini unless you specifically decide to install the google assistant (most people don’t AFAICT).

1 Like
3

The kind of translation capability that this Pixil 10 is promoted as having, seems quite different than anything we’ve seen before. Up until this device, voice language translation has been somewhat like talking to a robot on a CB radio, but with a time delay added also. So you would talk until you’re done talking and then you wait longer after you stop talking because after you stop talking, then the translated voice message is translated and spoken to the other person. So you take turns talking and waiting as the device would listen and then translate the message as a human translator would do, by not interrupting the person talking, but by waiting for the talking to stop before the translated message begins. By controlleing the audio on both ends of the call, by each caller having no other method to hear the other caller directly, and with real-time translation on both ends of the call going in both directions at the same time, it should be possible to hear the message in real time at the same time, in both directions, despite the language differences. I don’t know if any translation device like that has ever been on the market before. But in addition, the article that I read said that the AI learns your voice and uses your voice in the other language and with the appropriate emotional nuances included. If that is correct, it would sound exactly like the person who is speaking has mastered speaking in the other language.

1 Like
4

Worth drawing your attention to one of the replies:

There in no dilemma.
Wait until Pixel 10 is released and then wait until GrapheneOS is supported.

The fundamental question for any such translation functionality is … does it happen 100% on-device? Or does it necessarily involve sending information to the Google cloud? Is it dependent on the internet in any way? Does it unnecessarily send information to Google? (for “quality assurance purposes” … yeah, right)

Until you know the answer to that, you should not touch this functionality.

That said, the topic that you link to does not even mention this functionality, so a citation would help.

2 Likes
5

When it comes to whether or not to touch the functionality, one has to consider how the GrapheneOS team is tasked to do what they do. Although the hardware is made by Google, GraphineOS is supported by the opensource community and not Google. The phone’s operating system is purpose built to protect your security. And although we probably shouldn’t trust anyone, you have to trust someone. I think it’s probably safe to put the GrapheneOS software team in the same category as we put Purism, at least when it comes to their intent.

However I would be surprised if the GrapheneOS people do as good of a job as Purism does to actually create airtight security. Any firmware blobs in a Pixil phone are going to remain, even after the Android operating system that Google put on the phone has been completely erased and GrapheneOS installed. GrapheneOS actually has some pretty good Security countermeasures in place. It comes super secure by default and without anything from google installed. Then it comes with a whole ecosystem that protects you if you should choose to install the google software. Somehow, you usually do not have to decide between getting basic functions or not, as the price for getting access to most Android apps. You can install the Google framework and Google apps in to an ecosystem where neither Google nor the app has root access. The Google apps are taught how to behave appropriately and they lack the ability to communicate with the outside world or with other apps.

1 Like
6

Of course. Which means that in principle you can get an answer to the question (in the future when it actually exists).

However my comment was also addressing the possibility that someone just runs Android on their Pixel 10. Would we want to extend Google’s uber-surveillance model - as already applies to email, search, TV, docs, journeys, … - to voice phone calls?

Well, yes. It is basically impossible to guarantee that there is nothing lower level still in place in order to compromise your privacy. The entirety of the hardware (e.g. SoC and any ancillary processors) is Google-designed.

However my question was pitched at a less pernicious level - since traditionally it has been the case that low-powered devices didn’t have enough horsepower to handle speech on-device and speech therefore conveniently had to be sent to the cloud for processing (where it could be recorded / scanned for marketing opportunities / scanned for unauthorised thought processes / mirrored to your government / hacked / surrendered under court order / ..).

I guess this could raise an interesting question for law enforcement. They record a phone conversation between two persons of interest who are speaking different languages from each other. Real-time translation means that what the government records is not what the speaker actually said (assuming on-device processing). Nuance may be lost, meaning may change in subtle ways, or outright translation errors may be introduced.

In addition, identifying in court the parties to the phone call by voice could become trickier - since the voice too has to be synthesised / altered in some way - and hence also can be faked. What exactly do I sound like speaking Mandarin when I don’t speak Mandarin at all? (I have deliberately chosen Mandarin here, as a tonal language, to make it more difficult.)

2 Likes
7

That’s interesting and intriguing me! So, not being expert, I asked to ChatGPT 5 chat to suppose conspiracy and here what it said:

What could a malicious blob do inside a Pixel 10?

1. Microphones and audio

  • Constant listening: the audio firmware could intercept conversations even when the phone appears “off” (as long as it has power).

  • On-device processing: modern chips are powerful enough for real-time voice recognition (hotwords, basic analysis). A blob could turn the phone into a smart bug, activating only on keywords.

  • Silent transmission: if it has access to the modem/baseband, it could invisibly send selected audio snippets outside.

2. Camera and sensors

  • A camera blob could take photos or video without informing the operating system.

  • Combined with microphone and accelerometers, this could lead to behavioral tracking (are you walking? are you idle? are you talking to someone?).

3. Baseband (the phone’s modem)

  • The baseband is almost always an independent system with closed firmware.

  • It can intercept network data before it reaches the OS, effectively sniffing traffic, logging location, or tampering with calls and SMS.

  • Since it connects directly to cellular towers, it’s a potential hardware-level backdoor that GrapheneOS cannot eliminate—only contain.

4. GPS and geolocation

  • A blob controlling the GPS hardware could not only know your real location, but also:

    • Spoof it, feeding applications false coordinates.

    • Send it silently to external servers.

5. Translation / speech recognition (as discussed in the user’s exchange)

If Google (or another vendor) decided to push low-level translation AI, a more intriguing conspiracy risk emerges:

  • Your real voice may never reach your conversation partner; they hear only a pre-processed / translated / altered version.

  • You’d have no control over the accuracy or manipulation of the translation.

  • Official recordings (for courts, surveillance, etc.) might be transformed copies, not originals—introducing risks of errors or even abuses.

6. Biometric impersonation

If a blob manages the fingerprint sensor or facial recognition, then:

  • It could copy your biometric data and transmit it.

  • It could trick you into believing biometrics are stored “only on the device,” while secretly leaking them.

Practical risk level

  • Very realistic: low-level interception of conversations, location data, modem activity.

  • Moderately realistic: backdoors into camera and sensors. Possible, though harder to exploit without leaving traces.

  • More “near-term sci-fi” scenario: manipulated translations, synthetic voice impersonations, altered perception of reality. Not impossible, but likely a concern in the near future rather than right now.

The final irony

From an extreme conspiratorial standpoint: even with GrapheneOS hardened, blobs are little black boxes with godlike powers inside the phone. They could not only observe but potentially rewrite the history of what you said or did through your device. It’s like having police officers living underneath your floor: maybe they’re asleep… but if they wake up, no software lock will stop them.

@irvinewade what do you think about it? I was thinking to move from iPhone to Google Pixel fold (2023) with GrapheneOS in the meanwhile Librem 5 will be developed enough to be daily driver (it isn’t at all for now!) but after I read this post and ChatGPT considerations, maybe I stay with iPhone just because not true improvements in privacy and security moving to Pixel due to blobs!

2 Likes
8

The new scarry reality of AI is that now, not only is your phone or other device listening-in on you (we’ve known about that for some time now), but that with the help of AI, it’s like having a living person listening to every word you say, in understood, fully comprehended (for all practical purposes) in-contectual meaning. Anything and everything you say is no longer hidden amongst the words of billions of other people in a mix-up that no one will ever care to listen to. Now, there is always (every second of your life) someone listening who will report every time to the proper authorities, each and everything that those authorities want to know that you said.

There used to be a valid warning that said “do not joke to the police in the airport that you might have a gun". Bad things can happen to even the innocent and naive person, who makes that kind of joke. But now, you can’t even say the wrong thing even joking with your husband or wife in the privacy of your own home. If you innocently joke about wanting to kill some politician and you say it in the privacy of your own home now, no one will hear everything else you said that same day. But the AI will understand that this one sentence is worth reporting to either the police or to some other government agency. If you hate the President and you say as much too many times, your name might go on to a list somewhere. What you say even one time is no longer hidden inside of billions of pieces of uncatalogued data that will never be indexed. The point is that with AI, not only are you being spied upon every minute of the day, but that the spy is evaluating every word you say and decides with every word you ever say, if/when you’ve gone further than some real human person will approve of. And you will be reported every time. This has never happened before in the history of our species.

3 Likes
9

Reply to Irvinwade’s post:

But if two criminals who are plotting a crime (whether in different languages or not), are being listened to, the conversation may never need to be relevant in court. They plan to commit a specific crime at a specific time and place. The police are there waiting for them before they even arrive. They get caught while attempting to commit the crime. No further evidence is needed. No mis-understood parts of the phone conversation even matter.

1 Like
10

When it comes to the Librem 5 vs GrapheneOS vs any other Android phone, I have made perhaps an odd choice that seems the safest for me for now. I have one each of all three phones.

My Samsung Note 9 is my daily driver. It’s so old that updates are no longer available for it and my employer doesn’t even allow it to authenticate my access to their network, except via phone calls. I like it that way. The latest and greatest spying tools have not been installed to my Note 9. But it still does a lot of things for me, well.

My Pixil 6 with GrapheneOS on it is next in line to become my daily driver when my Note 9 becomes useless. I keep the Pixil 6 updated and I use it at home from time to time. It’ll be much older of a phone by the time my Note 9 dies. At that time, it will not have any of the latest and greatest of Spyware installed to it. But it will have GrapheneOS on it also.

When my Pixil 6 dies (maybe ten or more years from now), hopefully my Librem 5 will be ready for prime time by then. In the mean time, I am spending several years working with the Librem 5, learning how to use all of the Linux networking features on it, and occasionally installing or reinstalling the OS. By the time I really need my Librem 5, it’ll be no stranger to me. Both myself and the Librem 5 will be ready.

So my strategy is to avoid the latest and greatest technology when it comes to my phone. Stay under the radar as much as possible, and never run out of old phones that still work well. If some new and terribly invasive technology comes along on the new phone models, I can move to either the GrapheneOS Pixil 6 phone or to the Librem 5 at a moment’s notice. If nothing changes until ten or more years from now, I won’t be caught up then with the latest phone model, wishing I hadn’t gotten rid of my old phone. And when the current phone dies, I won’t be forced to buy a late model phone.

Ironically, I use Google Voice. My main number was ported to Google Voice and I forward my Google Voice number to all three phones, including to the Librem 5. All of my incoming calls can be answered on any of the three phones. I can’t call out from the Librem 5 using that Google Voice number as I can for the other two phones. But as soon as the SIP service is fixed on the Librem 5, I’ll be able to spoof my dial out number from the Librem 5, to show my Google Voice number. With a SIP service, spoofing your own number is super easy. I don’t care that Google probably retains transcripts of every call. I just don’t like microphones recording every moment I am awake, and I don’t like the web browser spying and advertising. The AI listening-in bothers me most. I don’t think that happens on my Note 9.

My significant other has a Samsung S22. It occasionally speaks up on its own and we don’t know how to shut it up petmanently. A few days ago, she asked me to turn something off in the car. Her phone replied “I don’t have the ability to turn anything off”. That kind of thing creeps me out. That’s never happened on my Note 9.

3 Likes
11

Same happening with Apple!! Sometimes it happens that Siri tells me stuff without I asked it using the activation code “hey, Siri”! I really hope Purism and Community will develop Librem 5 ASAP so to use it as daily driver in a reasonable time!

1 Like
12

Define reasonable.

1 Like
13

Before I become old and I die :joy::joy::joy:

let me say… 1 year since today? September 2026?

1 Like
14

In general terms, yes, all of those things are possible. I certainly won’t be using a Pixel. Ultimately it comes down to your appetite for risk and your threat model.

The most interesting one, that I think was also discussed in this forum recently, … with real-time machine translation from one natural language to another, whether on-device or leaking to some server on the internet, phone calls become as dodgy as many other forms of electronic communication. However this isn’t limited to the Pixel and isn’t limited to a problem with blobs. If what you are discussing on the phone with a party who does not speak your language is important then there is no way I would use machine translation.

The least interesting one is the cellular modem. We all understand that the other end of that communication is compromised anyway, whether by corporate interests or by government interests or both. However it should mention that GPS is sometimes built in to the cellular modem, so that in real-time your fairly accurate location can be transmitted to a nefarious party regardless of what the phone itself is doing (provided of course that there is power being provided).

It should also be borne in mind that in some countries the operating system is mandatorily compromised anyway. In that scenario, while blobs don’t help, they also don’t make much difference. So you would need to understand the situation in your own country.

2 Likes
15

Yes. And maybe that stands up in court even if the original interception was illegal.

Smart criminals might deliberately have misdirecting conversations over the phone though i.e. send the police off on some wild goose chase. The crims could even surveil the location so as to confirm absolutely that their calls are being intercepted.

1 Like
16

Using the fact in court that the interception was illegal isn’t possible in most cases. The police can always claim that they received an anonymous tip as long as they used the illegally obtained information to catch the bad guys, and not use the illegal information in court.

It does seem like preventing the interception should be essy. Set up SIP service on two Android or Apple phones. Set up end to end encryption of your data on both ends. Use a VPN on both ends. Not only would the conversation be private, but there would be no call log created anywhere as data transfers are not calls and the use of SIP would be invisible inside of a VPN tunnel.

2 Likes
17

The premise of some of the discussion is that at a deep level there is dodgy blackbox software (a blob) that no operating system can do anything about and that that blob is what leads to the interception. In that scenario you cannot rely on a VPN achieving anything whatsoever because the endpoint itself is compromised. Obviously if you use two Android/Apple spyphones then you are making it too easy. The premise was … heh, let’s at least make it a bit more challenging by using GrapheneOS (thereby forcing the malicious party to embed their spyware in a blob).

Sure, a VPN+E2EE is solid to keep the content of the phone call private if the only dodgy blackbox software is in the modem.

But let’s say that the modem also has a dodgy blackbox driver. All bets are off. Your privacy is toast.

1 Like
18

…and tobtop it off, Purism puts most or all of their programming resources in to Crimson, while the broken (for SIP use) Gnome dialer languishes, unable to provide absolute security for voice communications that are certainly possible. In my scenario where two Android phones are used, irvinewade is correct. The blobs make it impossible to have any confidence in the Security of voice communications. Even AwSim customers can’t count on the Security of their voice communications on the Librem 5, which absolute security is certainly possible via SIP.

Why not slow down the mad dash to release Crimson and say something like “you know what, we’re not going to release Crimson until we either fix the Gnome dialer, or replace the Gnome dialer with a different dialer that is not broken. That fix will go in to Crimson".

When I am somewhere for any extended period of time, I would really like to turn off my SIM card, connect to WiFi, turn off the GPS, and become completely invisible that way while also still being able to receive phone calls via SIP. I would much rather have SIP working on my Librem 5 than the Camera or even GPS. What good is Crimson if my Librem 5 sits at home in a drawer all day every day? Purism needs to make the best features work sooner rather than when they get around to it.

2 Likes
19

Apologies if you already stated this but have you tested SIP on crimson? (The implication of your dichotomy is that SIP still doesn’t work on crimson.)

Two observations though:

  • Every customer has different priorities.
  • It is sometimes necessary to get low level plumbing sorted out first before high level applications get fixed, even though the former has lower visibility and doesn’t look like much bang for your buck.
2 Likes
20

If your phone doesn’t have a big battery house, you guys are missing out on one of the greatest phone features ever. Are you able to locate the Pixel 10 specs to build a big battery house for it?

1 Like